USMetrics
Pass
Audited by Gen Agent Trust Hub on Aug 2, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill fetches economic and social data from official government API endpoints, including the St. Louis Fed's FRED API (api.stlouisfed.org), the Energy Information Administration (api.eia.gov), and the US Treasury (api.fiscaldata.treasury.gov). These are well-known, trusted data providers.
- [COMMAND_EXECUTION]: The skill executes local TypeScript tools included in the skill package, such as Tools/UpdateSubstrateMetrics.ts and Tools/GenerateAnalysis.ts, using the Bun runtime to process data and generate reports.
- [DATA_EXFILTRATION]: The skill sends status notifications to a local endpoint at http://localhost:31337/notify. This is a standard mechanism for providing local feedback to the user during skill execution and does not represent a data exfiltration risk.
- [SAFE]: No malicious patterns such as prompt injection, obfuscation, persistence mechanisms, or unauthorized privilege escalation were identified. The skill follows best practices by loading user customizations from a specific local path and logging execution status to a local file.
Audit Metadata